Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Opaque Token Introspection Strategy Flexibility #7344

Closed
jzheaux opened this issue Sep 3, 2019 · 0 comments
Closed

Opaque Token Introspection Strategy Flexibility #7344

jzheaux opened this issue Sep 3, 2019 · 0 comments
Assignees
@jzheaux
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement
Milestone
5.2.0.RC1

Comments

@jzheaux
Copy link
Contributor

jzheaux commented Sep 3, 2019 •
edited
Loading

Most of the opaque token support anticipates the use of the OAuth 2.0 Introspection specification. For example, the authentication provider is OAuth2IntrospectionAuthenticationProvider.

This really isn't true though, since the contract is simply String -> Map of attributes. It's sensible to hit any trusted API that will exchange something that is opaque to the resource server for an attribute map. Thus, something like OpaqueTokenAuthenticationProvider is more sensible.

This aligns with the DSL: jwt() configures a JwtAuthenticationProvider and now opaqueToken() would configure an OpaqueTokenAuthenticationProvider.

On the same note, OAuth2IntrospectionAuthenticationToken implies an OAuth 2.0 Introspection authentication strategy, which may not be true. Instead, let's use BearerTokenAuthentication.
@jzheaux jzheaux added the in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) label Sep 3, 2019
@jzheaux jzheaux self-assigned this Sep 3, 2019
@jzheaux jzheaux added the type: enhancement A general enhancement label Sep 3, 2019
@jzheaux jzheaux added this to the 5.2.0.RC1 milestone Sep 3, 2019
jzheaux added a commit to jzheaux/spring-security that referenced this issue Sep 3, 2019
@jzheaux
Polish Opaque Token
bfee33a 
Use OAuth2AuthenticatedPrincipal
Use BearerTokenAuthentication
Update names to reflect more generic approach.

Fixes spring-projectsgh-7344
Fixes spring-projectsgh-7345
@jzheaux jzheaux closed this as completed in 068f4f0 Sep 3, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jzheaux jzheaux

Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement
Projects
None yet
Milestone
5.2.0.RC1
Development

No branches or pull requests
1 participant
@jzheaux